Euro websites spread Bofra worm via banner ads

'Register' visitors among those that may be infected

Website visitors who clicked on banner ads on a number of popular European websites this weekend could have infected their computers with variants of the Bofra worm, experts warned on Monday.

The attacks take advantage of an unpatched buffer overflow flaw in the way Internet Explorer 6 (IE) handles the IFrame tag, and has been confirmed on PCs running Windows XP with Service Pack 1 and Windows 2000, according to a warning posted on Sunday on the SANS (SysAdmin, Audit, Network, Security) Institute website. Windows XP Service Pack 2 (SP2) is not vulnerable, it said.

The vulnerability allows attackers to gain complete control of a user's computer.

Also on Sunday, UK technology news website The Register reported that its third party ad serving company Falk AG became infected with the Bofra/IFrame exploit, forcing the website to suspend its ads from Falk.

"If you may have visited The Register between 6am and 12.30pm GMT on Saturday, November 20 using any Windows platform bar XP SP2 we strongly advise you to check your machine with up to date antivirus software, to install SP2 if you are running Windows XP, and to strongly consider running an alternative browser, at least until Microsoft deals with the issue," The Register said on its website.

According to SANS, there were also reports of sites in Sweden and the Netherlands being compromised by the malicious code.

In the Netherlands, the country's biggest news site,, with over 450,000 unique visitors per month, was infected through the ad system of Falk AG and served the code to its visitors. Additionally, the other sites of Ilse Media BV, including one of the largest Dutch sites Startpagina, distributed the Trojan horse as well.

Adserver tags and link addresses were manipulated in order to install and execute the malware. User requests were redirected from Falk's servers to the URL "", from where the malicious code was delivered, Falk said in a statement.

Falk's competitor Adtech AG released its own statement saying that its adserving system Helios was not affected by the problem.

Microsoft has yet to issue a patch for the IE IFrame hole for users who have not installed SP2. However, some "unofficial" patches have been released.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

More about MicrosoftNU

Show Comments